@cotal-ai/auth 0.88.0 → 0.90.0

package/dist/native-issuance.d.ts

@@ -9,6 +9,7 @@
  * that do not write it, and static (non-callout) JWTs have no row and are never inferred.
  */
 import type { KV } from "@nats-io/kv";
+import { type ServiceConnectionBinding, type ServiceRegistrationWitness } from "@cotal-ai/core";
 import { type ValidatedUserToken } from "./token.js";
 import { type LifecycleRegistry } from "./lifecycle-registry.js";
 /** The closed v1 record. `connId` is the client's inbox nonce: an attribute, never an identity. */
@@ -24,6 +25,11 @@ export interface NativeIssuanceRecord {
     /** The minted inner JWT's own `iat` and `exp` (seconds); a session-caller's is its grant's. */
     iat: number;
     exp: number;
+    service?: {
+        witness: ServiceRegistrationWitness;
+        credentialId: string;
+        connection: ServiceConnectionBinding;
+    };
 }
 /** One callout success, handed to the recorder after the mint and before the response. */
 export interface NativeIssuance {
@@ -32,6 +38,10 @@ export interface NativeIssuance {
     connId: string;
     iat: number;
     exp: number;
+    service?: {
+        credentialId: string;
+        connection: ServiceConnectionBinding;
+    };
 }
 export type NativeIssuanceRecorder = (issuance: NativeIssuance) => Promise<void>;
 /** Build the record from the validated token alone: never from a fresh alias lookup. */
@@ -53,10 +63,12 @@ export declare function readNativeIssuance(kv: KV, userNkey: string): Promise<Na
  * `STREAM.MSG.GET` `next_by_subj` read over `natkey.` (no consumer: none may be created on the auth
  * bucket), and each removal is a KV purge pinned to the exact sequence read. A row that does not
  * parse throws: corrupt evidence is the caller's fault to surface, never a skipped row. The purge
- * marker carries the bucket's own marker TTL, so it expires too.
+ * marker carries the bucket's own marker TTL, so it expires too. Expired service evidence is
+ * retained: elapsed JWT time alone is not topology-qualified absence or terminal retirement.
  */
 export declare function pruneNativeIssuance(registry: LifecycleRegistry, nowSec: number): Promise<{
     live: number;
     pruned: number;
+    retainedService: number;
 }>;
 //# sourceMappingURL=native-issuance.d.ts.map

package/dist/native-issuance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-issuance.d.ts","sourceRoot":"","sources":["../src/native-issuance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAItC,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjF,mGAAmG;AACnG,MAAM,WAAW,oBAAoB;IACnC,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,0FAA0F;AAC1F,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,sBAAsB,GAAG,CAAC,QAAQ,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAejF,wFAAwF;AACxF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,cAAc,GAAG,oBAAoB,CAQ3F;AAED,oEAAoE;AACpE,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB,CAW5E;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAQ/I;AAED,qGAAqG;AACrG,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAI5G;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBhI"}
+{"version":3,"file":"native-issuance.d.ts","sourceRoot":"","sources":["../src/native-issuance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGtC,OAAO,EAGL,KAAK,wBAAwB,EAAE,KAAK,0BAA0B,EAC/D,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjF,mGAAmG;AACnG,MAAM,WAAW,oBAAoB;IACnC,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,0BAA0B,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,wBAAwB,CAAA;KAAE,CAAC;CAC/G;AAED,0FAA0F;AAC1F,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,wBAAwB,CAAA;KAAE,CAAC;CAC1E;AAED,MAAM,MAAM,sBAAsB,GAAG,CAAC,QAAQ,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAoCjF,wFAAwF;AACxF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,cAAc,GAAG,oBAAoB,CAe3F;AAED,oEAAoE;AACpE,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB,CAqB5E;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAkB/I;AAED,qGAAqG;AACrG,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAM5G;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,CAwBzJ"}

package/dist/native-issuance.js

@@ -1,5 +1,5 @@
 import { fromPublic } from "@nats-io/nkeys";
-import { EP_AUTH_MARKER_TTL_MS, epAuthBucket, nativeIssuanceKey } from "@cotal-ai/core";
+import { EP_AUTH_MARKER_TTL_MS, SERVICE_ACCESS_TTL_SECONDS, contractDigest, epAuthBucket, epcredRowKey, nativeIssuanceKey, parseLedgerRow, parseServiceConnectionBinding, parseServiceRegistrationWitness, } from "@cotal-ai/core";
 import { CLOCK_TOLERANCE_SEC } from "./token.js";
 import { registryStores } from "./lifecycle-registry.js";
 const FIELDS = ["v", "space", "owner", "actor", "lifecycleUid", "credentialId", "view", "connId", "iat", "exp"];
@@ -13,6 +13,28 @@ function assertSeconds(v, what) {
         throw new Error(`natkey: ${what} must be a positive integer of seconds`);
     return v;
 }
+function parseServiceEvidence(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        throw new Error("natkey: invalid service evidence");
+    const o = raw;
+    if (Object.keys(o).length !== 3 || Object.keys(o).some((k) => !["witness", "credentialId", "connection"].includes(k))
+        || typeof o.credentialId !== "string")
+        throw new Error("natkey: invalid service evidence");
+    const witness = parseServiceRegistrationWitness(o.witness), connection = parseServiceConnectionBinding(o.connection);
+    epcredRowKey(witness.endpoint, witness.instanceId, o.credentialId);
+    return { witness, credentialId: o.credentialId, connection };
+}
+async function verifyServiceEvidence(kv, record) {
+    const service = record.service;
+    const key = epcredRowKey(service.witness.endpoint, service.witness.instanceId, service.credentialId), entry = await kv.get(key);
+    if (!entry || entry.operation !== "PUT")
+        throw new Error("natkey: service issuance evidence is unavailable");
+    const row = parseLedgerRow(entry.value, key);
+    if (row.state !== "active" || row.holderPrincipal !== `${record.owner}.${record.actor}` || row.exp !== record.exp
+        || row.sourceChain.length !== 1 || row.sourceChain[0] !== "root" || !row.serviceConnection
+        || contractDigest(row.serviceConnection) !== contractDigest(service.connection))
+        throw new Error("natkey: service issuance evidence does not match the connection");
+}
 /** Build the record from the validated token alone: never from a fresh alias lookup. */
 export function nativeIssuanceRecord(space, i) {
     const t = i.token;
@@ -24,14 +46,26 @@ export function nativeIssuanceRecord(space, i) {
     const iat = assertSeconds(i.iat, "iat"), exp = assertSeconds(i.exp, "exp");
     if (exp <= iat)
         throw new Error("natkey: exp must follow iat");
-    return { v: 1, space, owner: t.owner, actor: t.act.actor, lifecycleUid, credentialId, view: t.act.view ?? "agent", connId: i.connId, iat, exp };
+    const record = { v: 1, space, owner: t.owner, actor: t.act.actor, lifecycleUid, credentialId,
+        view: t.act.view ?? "agent", connId: i.connId, iat, exp };
+    if (t.act.view === "service-endpoint") {
+        if (!i.service || !t.act.service || exp > t.exp)
+            throw new Error("natkey: service issuance requires bounded native evidence");
+        record.service = parseServiceEvidence({ ...i.service, witness: t.act.service.witness });
+        if (record.service.connection.userNkey !== i.userNkey)
+            throw new Error("natkey: service evidence names a different user key");
+    }
+    else if (i.service !== undefined)
+        throw new Error("natkey: ordinary issuance cannot carry service evidence");
+    return record.service ? parseNativeIssuanceRecord(record) : record;
 }
 /** Parse a stored row; anything but the closed v1 shape refuses. */
 export function parseNativeIssuanceRecord(raw) {
     if (typeof raw !== "object" || raw === null || Array.isArray(raw))
         throw new Error("natkey: record is not an object");
     const keys = Object.keys(raw);
-    if (keys.length !== FIELDS.length || !FIELDS.every((f) => keys.includes(f)))
+    if (keys.length !== FIELDS.length + (Object.hasOwn(raw, "service") ? 1 : 0) || !FIELDS.every((f) => keys.includes(f))
+        || keys.some((key) => key !== "service" && !FIELDS.includes(key)))
         throw new Error(`natkey: record fields ${JSON.stringify(keys.sort())} are not the closed v1 set`);
     const r = raw;
     if (r.v !== 1)
@@ -41,6 +75,16 @@ export function parseNativeIssuanceRecord(raw) {
             throw new Error(`natkey: record ${f} is not a non-empty string`);
     assertSeconds(r.iat, "iat");
     assertSeconds(r.exp, "exp");
+    if ((r.view === "service-endpoint") !== Object.hasOwn(r, "service"))
+        throw new Error("natkey: service view and evidence must occur together");
+    if (r.service !== undefined) {
+        const service = parseServiceEvidence(r.service), witness = service.witness;
+        if (r.space !== witness.space || r.owner !== witness.principal.owner || r.actor !== witness.principal.actor
+            || r.lifecycleUid !== witness.principal.lifecycleUid || r.credentialId !== witness.rootCredentialId
+            || r.exp <= r.iat || r.exp > r.iat + SERVICE_ACCESS_TTL_SECONDS)
+            throw new Error("natkey: service evidence does not match its native root and lifetime");
+        return { ...r, service };
+    }
     return r;
 }
 /**
@@ -54,8 +98,21 @@ export function makeNativeIssuanceRecorder(registry, fence) {
     return async (i) => {
         const key = assertUserNkey(i.userNkey);
         const record = nativeIssuanceRecord(space, i);
-        await authKv.create(key, new TextEncoder().encode(JSON.stringify(record)));
-        await fence(i.token);
+        const token = record.service ? structuredClone(i.token) : i.token;
+        const bytes = new TextEncoder().encode(JSON.stringify(record));
+        if (record.service) {
+            await verifyServiceEvidence(authKv, record);
+            await authKv.put(key, bytes, { previousSeq: 0 });
+            await verifyServiceEvidence(authKv, record);
+            const stored = await readNativeIssuance(authKv, i.userNkey);
+            if (!stored || contractDigest(stored) !== contractDigest(record))
+                throw new Error("natkey: service receipt changed before release");
+        }
+        else
+            await authKv.create(key, bytes);
+        await fence(token);
+        if (record.service && record.exp <= Math.floor(Date.now() / 1000))
+            throw new Error("natkey: service issuance expired before release");
     };
 }
 /** Leader-read one key's evidence (the auth bucket is not Direct-capable). Absent is `undefined`. */
@@ -63,7 +120,10 @@ export async function readNativeIssuance(kv, userNkey) {
     const entry = await kv.get(assertUserNkey(userNkey));
     if (!entry || entry.operation !== "PUT")
         return undefined;
-    return parseNativeIssuanceRecord(entry.json());
+    const record = parseNativeIssuanceRecord(entry.json());
+    if (record.service && record.service.connection.userNkey !== userNkey)
+        throw new Error("natkey: service receipt key does not match its connection");
+    return record;
 }
 /**
  * Remove the rows whose minted JWT expired more than the clock tolerance ago (a session-caller's
@@ -71,13 +131,14 @@ export async function readNativeIssuance(kv, userNkey) {
  * `STREAM.MSG.GET` `next_by_subj` read over `natkey.` (no consumer: none may be created on the auth
  * bucket), and each removal is a KV purge pinned to the exact sequence read. A row that does not
  * parse throws: corrupt evidence is the caller's fault to surface, never a skipped row. The purge
- * marker carries the bucket's own marker TTL, so it expires too.
+ * marker carries the bucket's own marker TTL, so it expires too. Expired service evidence is
+ * retained: elapsed JWT time alone is not topology-qualified absence or terminal retirement.
  */
 export async function pruneNativeIssuance(registry, nowSec) {
     const { authKv, jsm, space } = registryStores(registry);
     const bucket = epAuthBucket(space);
     const prefix = `$KV.${bucket}.`;
-    let seq = 1, live = 0, pruned = 0;
+    let seq = 1, live = 0, pruned = 0, retainedService = 0;
     for (;;) {
         const m = await jsm.streams.getMessage(`KV_${bucket}`, { seq, next_by_subj: `${prefix}natkey.>` });
         if (!m)
@@ -90,13 +151,18 @@ export async function pruneNativeIssuance(registry, nowSec) {
         if (assertUserNkey(key.slice("natkey.".length)) !== key)
             throw new Error(`natkey: stored subject ${JSON.stringify(m.subject)} is not a natkey row`);
         const record = parseNativeIssuanceRecord(m.json());
-        if (record.exp + CLOCK_TOLERANCE_SEC < nowSec) {
+        if (record.service && nativeIssuanceKey(record.service.connection.userNkey) !== key)
+            throw new Error("natkey: service receipt key does not match its connection");
+        if (record.exp + CLOCK_TOLERANCE_SEC < nowSec && record.service) {
+            retainedService++;
+        }
+        else if (record.exp + CLOCK_TOLERANCE_SEC < nowSec) {
             await authKv.purge(key, { previousSeq: m.seq, ttl: `${EP_AUTH_MARKER_TTL_MS / 1000}s` });
             pruned++;
         }
         else
             live++;
     }
-    return { live, pruned };
+    return { live, pruned, retainedService };
 }
 //# sourceMappingURL=native-issuance.js.map

package/dist/native-issuance.js.map

@@ -1 +1 @@
-{"version":3,"file":"native-issuance.js","sourceRoot":"","sources":["../src/native-issuance.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAA2B,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,cAAc,EAA0B,MAAM,yBAAyB,CAAC;AA4BjF,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAEzH,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,uDAAuD;IAC7E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,CAAU,EAAE,IAAY;IAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,wCAAwC,CAAC,CAAC;IAC1I,OAAO,CAAC,CAAC;AACX,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,CAAiB;IACnE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IAClB,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC5H,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;IAC7C,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;IACxL,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3E,IAAI,GAAG,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC/D,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAClJ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACtH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,4BAA4B,CAAC,CAAC;IAC/K,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAU;QACpG,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;IAChH,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,CAAoC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAA2B,EAAE,KAA+C;IACrH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACnD,OAAO,KAAK,EAAE,CAAC,EAAE,EAAE;QACjB,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,QAAgB;IAC/D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC1D,OAAO,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAA2B,EAAE,MAAc;IACnF,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,OAAO,MAAM,GAAG,CAAC;IAChC,IAAI,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC;IAClC,SAAS,CAAC;QACR,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,MAAM,UAAU,EAA2B,CAAC,CAAC;QAC5H,IAAI,CAAC,CAAC;YAAE,MAAM;QACd,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAChB,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QACzC,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,OAAO;YAAE,SAAS;QAC7C,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACpJ,MAAM,MAAM,GAAG,yBAAyB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,GAAG,GAAG,mBAAmB,GAAG,MAAM,EAAE,CAAC;YAC9C,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,qBAAqB,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;YACzF,MAAM,EAAE,CAAC;QACX,CAAC;;YAAM,IAAI,EAAE,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"native-issuance.js","sourceRoot":"","sources":["../src/native-issuance.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAChH,cAAc,EAAE,6BAA6B,EAAE,+BAA+B,GAE/E,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAA2B,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,cAAc,EAA0B,MAAM,yBAAyB,CAAC;AA8BjF,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAEzH,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,uDAAuD;IAC7E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,CAAU,EAAE,IAAY;IAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,wCAAwC,CAAC,CAAC;IAC1I,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC/G,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;WAChH,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAG,+BAA+B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,6BAA6B,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACrH,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;IACnE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,EAAM,EAAE,MAA4B;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAQ,CAAC;IAChC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChI,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC7G,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,eAAe,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;WAC5G,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB;WACvF,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;AACvF,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,CAAiB;IACnE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IAClB,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC5H,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;IAC7C,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;IACxL,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3E,IAAI,GAAG,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAyB,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,YAAY;QAChH,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC5D,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC9H,MAAM,CAAC,OAAO,GAAG,oBAAoB,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACxF,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAChI,CAAC;SAAM,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC/G,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACrE,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACtH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;WAChH,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,CAAE,MAA4B,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,4BAA4B,CAAC,CAAC;IAC9L,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAU;QACpG,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;IAChH,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC9I,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC3E,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK;eACtG,CAAC,CAAC,YAAY,KAAK,OAAO,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,KAAK,OAAO,CAAC,gBAAgB;eAC/F,CAAC,CAAC,GAAc,IAAK,CAAC,CAAC,GAAc,IAAK,CAAC,CAAC,GAAc,GAAI,CAAC,CAAC,GAAc,GAAG,0BAA0B;YAC/G,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAqC,CAAC;IAC9D,CAAC;IACD,OAAO,CAAoC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAA2B,EAAE,KAA+C;IACrH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACnD,OAAO,KAAK,EAAE,CAAC,EAAE,EAAE;QACjB,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAClE,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACtI,CAAC;;YAAM,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACvE,CAAC,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,QAAgB;IAC/D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACpJ,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAA2B,EAAE,MAAc;IACnF,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,OAAO,MAAM,GAAG,CAAC;IAChC,IAAI,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC;IACvD,SAAS,CAAC;QACR,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,MAAM,UAAU,EAA2B,CAAC,CAAC;QAC5H,IAAI,CAAC,CAAC;YAAE,MAAM;QACd,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAChB,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QACzC,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,OAAO;YAAE,SAAS;QAC7C,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACpJ,MAAM,MAAM,GAAG,yBAAyB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,OAAO,IAAI,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,GAAG;YACjF,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,IAAI,MAAM,CAAC,GAAG,GAAG,mBAAmB,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAChE,eAAe,EAAE,CAAC;QACpB,CAAC;aAAM,IAAI,MAAM,CAAC,GAAG,GAAG,mBAAmB,GAAG,MAAM,EAAE,CAAC;YACrD,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,qBAAqB,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;YACzF,MAAM,EAAE,CAAC;QACX,CAAC;;YAAM,IAAI,EAAE,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AAC3C,CAAC"}

package/dist/native-service-callout.d.ts

@@ -0,0 +1,38 @@
+import { type ServiceConnectionBinding, type ServiceRegistrationWitness } from "@cotal-ai/core";
+import type { ConnectReader } from "./connect-reader.js";
+import { type LifecycleRegistry } from "./lifecycle-registry.js";
+import { type ServiceAssignmentBinding } from "./native-service-gate.js";
+import type { ValidatedUserToken } from "./token.js";
+export interface NativeServiceCalloutAuthority {
+    readonly space: string;
+    readonly accountPublicKey: string;
+}
+interface ServiceCalloutContext {
+    connection: ServiceConnectionBinding;
+    inboxNonce: string;
+    admittedAt: number;
+}
+interface ServiceCalloutResult {
+    jwt: string;
+    principal: string;
+    exp: number;
+}
+/** Native host composition only. Assignment lookup and restore/mutation readiness belong to the
+ * host; neither callback is a public approval hook. Services receive no registry or signing key.
+ */
+export declare function createNativeServiceCalloutAuthority(opts: {
+    registry: LifecycleRegistry;
+    reader: () => ConnectReader;
+    dataAccount: {
+        pub: string;
+        signingSeed: string;
+    };
+    resolveAssignment: (witness: ServiceRegistrationWitness) => Promise<ServiceAssignmentBinding>;
+    readClusterArtifact: (digest: string) => unknown | Promise<unknown>;
+    assertOpen: () => void;
+}): NativeServiceCalloutAuthority;
+/** A structural object cannot opt into native service minting or select another tenant account. */
+export declare function assertNativeServiceCalloutAuthority(authority: NativeServiceCalloutAuthority, space: string, accountPublicKey: string): void;
+export declare function issueNativeServiceCallout(authority: NativeServiceCalloutAuthority, token: ValidatedUserToken, context: ServiceCalloutContext): Promise<ServiceCalloutResult>;
+export {};
+//# sourceMappingURL=native-service-callout.d.ts.map

package/dist/native-service-callout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-service-callout.d.ts","sourceRoot":"","sources":["../src/native-service-callout.ts"],"names":[],"mappings":"AAAA,OAAO,EAE+D,KAAK,wBAAwB,EAAE,KAAK,0BAA0B,EACnI,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjF,OAAO,EAAkD,KAAK,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE;AAC5G,UAAU,qBAAqB;IAAG,UAAU,EAAE,wBAAwB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AAChH,UAAU,oBAAoB;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AAI9E;;GAEG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,EAAE;IACxD,QAAQ,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,aAAa,CAAC;IAAC,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5G,iBAAiB,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9F,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,UAAU,EAAE,MAAM,IAAI,CAAC;CAC7F,GAAG,6BAA6B,CA6ChC;AAED,mGAAmG;AACnG,wBAAgB,mCAAmC,CAAC,SAAS,EAAE,6BAA6B,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAG3I;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,6BAA6B,EAAE,KAAK,EAAE,kBAAkB,EAC3G,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAI/D"}

package/dist/native-service-callout.js

@@ -0,0 +1,71 @@
+import { SERVICE_ACCESS_TTL_SECONDS, authorizeServeGrant, contractDigest, mintServiceCalloutJwt, parseServiceConnectionBinding, parseServiceRegistrationWitness, principalKey, serveIssuanceGateKv, } from "@cotal-ai/core";
+import { registryStores } from "./lifecycle-registry.js";
+import { makeNativeIssuanceRecorder } from "./native-issuance.js";
+import { readNativeServiceAccess, readNativeServiceGate } from "./native-service-gate.js";
+import { nativeServiceNameAuthority } from "./native-service-name.js";
+const authorities = new WeakMap();
+/** Native host composition only. Assignment lookup and restore/mutation readiness belong to the
+ * host; neither callback is a public approval hook. Services receive no registry or signing key.
+ */
+export function createNativeServiceCalloutAuthority(opts) {
+    const { registry, reader, resolveAssignment, readClusterArtifact, assertOpen } = opts;
+    const dataAccount = { ...opts.dataAccount }, stores = registryStores(registry), space = stores.space;
+    const authority = Object.freeze({ space, accountPublicKey: dataAccount.pub });
+    const names = nativeServiceNameAuthority(registry, { space, accountPublicKey: dataAccount.pub });
+    authorities.set(authority, async (raw, supplied) => {
+        const token = structuredClone(raw), connection = parseServiceConnectionBinding(supplied.connection);
+        const { inboxNonce, admittedAt } = supplied, expiresAt = Math.min(token.exp, admittedAt + SERVICE_ACCESS_TTL_SECONDS);
+        if (!Number.isSafeInteger(admittedAt) || admittedAt <= 0 || admittedAt > Math.floor(Date.now() / 1000)
+            || !Number.isSafeInteger(expiresAt) || expiresAt <= Math.floor(Date.now() / 1000))
+            throw new Error("service callout requires its original live admission deadline");
+        if (token.act.view !== "service-endpoint" || !token.act.service)
+            throw new Error("service callout requires a validated service bearer");
+        const witness = parseServiceRegistrationWitness(token.act.service.witness);
+        if (witness.accountPublicKey !== dataAccount.pub || witness.space !== space)
+            throw new Error("service callout bearer belongs to another native account or space");
+        assertOpen();
+        const binding = { ...await resolveAssignment(witness) }, bindingDigest = contractDigest(binding);
+        if (binding.accountPublicKey !== dataAccount.pub || binding.space !== space)
+            throw new Error("service callout assignment belongs to another native account or space");
+        await readNativeServiceAccess(registry, reader(), binding, token, expiresAt);
+        const serve = await authorizeServeGrant(stores.recordsKv, { space, endpoint: witness.endpoint, instanceId: witness.instanceId,
+            epoch: witness.processEpoch, holder: { owner: witness.principal.owner }, authority: names, readClusterArtifact,
+            readProcessEpoch: async () => {
+                const gate = await readNativeServiceGate(registry, binding);
+                if (!gate)
+                    throw new Error("service callout has no native gate");
+                return gate.row.processEpoch;
+            } });
+        assertOpen();
+        const minted = await mintServiceCalloutJwt({ space, account: dataAccount }, { serve,
+            gate: serveIssuanceGateKv(stores.authKv, space, { endpoint: witness.endpoint, instanceId: witness.instanceId }),
+            principal: witness.principal, connection, inboxNonce, admittedAt, accessExpiresAt: token.exp, expiresAt });
+        const record = makeNativeIssuanceRecorder(registry, async (currentToken) => {
+            assertOpen();
+            const current = { ...await resolveAssignment(witness) };
+            if (contractDigest(current) !== bindingDigest)
+                throw new Error("service assignment changed before callout release");
+            await readNativeServiceAccess(registry, reader(), current, currentToken, expiresAt);
+            assertOpen();
+        });
+        await record({ userNkey: connection.userNkey, token, connId: inboxNonce, iat: minted.iat, exp: minted.exp,
+            service: { credentialId: minted.credentialId, connection } });
+        assertOpen();
+        if (expiresAt <= Math.floor(Date.now() / 1000))
+            throw new Error("service callout expired before response");
+        return { jwt: minted.jwt, principal: principalKey(witness.principal.owner, witness.principal.actor).key, exp: expiresAt };
+    });
+    return authority;
+}
+/** A structural object cannot opt into native service minting or select another tenant account. */
+export function assertNativeServiceCalloutAuthority(authority, space, accountPublicKey) {
+    if (!authorities.has(authority) || authority.space !== space || authority.accountPublicKey !== accountPublicKey)
+        throw new Error("service callout authority is not native or belongs to another account/space");
+}
+export function issueNativeServiceCallout(authority, token, context) {
+    const issue = authorities.get(authority);
+    if (!issue)
+        throw new Error("service callout authority is not native");
+    return issue(token, context);
+}
+//# sourceMappingURL=native-service-callout.js.map

package/dist/native-service-callout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-service-callout.js","sourceRoot":"","sources":["../src/native-service-callout.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAAE,mBAAmB,EAAE,cAAc,EAAE,qBAAqB,EAAE,6BAA6B,EACrH,+BAA+B,EAAE,YAAY,EAAE,mBAAmB,GACnE,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,cAAc,EAA0B,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAiC,MAAM,0BAA0B,CAAC;AACzH,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAOtE,MAAM,WAAW,GAAG,IAAI,OAAO,EAAwC,CAAC;AAExE;;GAEG;AACH,MAAM,UAAU,mCAAmC,CAAC,IAInD;IACC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IACtF,MAAM,WAAW,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IACrG,MAAM,SAAS,GAAkC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7G,MAAM,KAAK,GAAG,0BAA0B,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;IACjG,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE;QACjD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,6BAA6B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACpG,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,GAAG,0BAA0B,CAAC,CAAC;QACtH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;eACjG,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACxI,MAAM,OAAO,GAAG,+BAA+B,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,gBAAgB,KAAK,WAAW,CAAC,GAAG,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;YACzE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,UAAU,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,EAAE,EAAE,aAAa,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACjG,IAAI,OAAO,CAAC,gBAAgB,KAAK,WAAW,CAAC,GAAG,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;YACzE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,MAAM,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU;YAC3H,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB;YAC9G,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBAC3B,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC5D,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACjE,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YAC/B,CAAC,EAAE,CAAC,CAAC;QACP,UAAU,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK;YACjF,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;YAC/G,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7G,MAAM,MAAM,GAAG,0BAA0B,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;YACzE,UAAU,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACpH,MAAM,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YACpF,UAAU,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG;YACvG,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAChE,UAAU,EAAE,CAAC;QACb,IAAI,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC3G,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IAC5H,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,mCAAmC,CAAC,SAAwC,EAAE,KAAa,EAAE,gBAAwB;IACnI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK,IAAI,SAAS,CAAC,gBAAgB,KAAK,gBAAgB;QAC7G,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,SAAwC,EAAE,KAAyB,EAC3G,OAA8B;IAC9B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC/B,CAAC"}

package/dist/native-service-gate.d.ts

@@ -0,0 +1,72 @@
+import { type EndpointGateRow, type EpCapability, type ServiceGateAuthority, type ServiceRegistrationWitness } from "@cotal-ai/core";
+import type { ConnectReader } from "./connect-reader.js";
+import type { ValidatedUserToken } from "./token.js";
+import { type LifecycleRegistry } from "./lifecycle-registry.js";
+export interface ServiceAssignmentBinding {
+    accountPublicKey: string;
+    space: string;
+    owner: string;
+    endpoint: string;
+    instanceId: string;
+    lifecycleUid: string;
+    assignmentDigest: string;
+}
+type ServiceRow = EndpointGateRow & {
+    authorityFamily: "service";
+    serviceAuthority: ServiceGateAuthority;
+};
+interface ServiceGateRead {
+    row: ServiceRow;
+    revision: number;
+}
+/** Internal host storage seam. Consent and name authority are not established by a gate write. */
+export declare function readNativeServiceGate(reg: LifecycleRegistry, binding: ServiceAssignmentBinding): Promise<ServiceGateRead | undefined>;
+/** Package-internal pure endpoint-gate rows for a writer that issues, bounds and re-checks every
+ *  request itself. No I/O: the same rows and checks the helpers below write and read. */
+export interface ServiceGateRows {
+    readonly key: string;
+    /** Parse bytes read at `key`; `conflict` when they belong to another immutable assignment. */
+    parse(value: Uint8Array): ServiceRow;
+    /** Bytes of the pending-root row that a zero-history create writes. */
+    readonly pending: Uint8Array;
+    /** Bytes of the frozen revoked row that a zero-history create writes before the gate exists. */
+    uncreatedFence(operationId: string): Uint8Array;
+    /** Bytes of the deny-new successor of `row`, or `undefined` when it is already revoked. */
+    deny(row: ServiceRow, operationId: string): Uint8Array | undefined;
+}
+/** The pure endpoint-gate rows of one assignment in this registry's space. */
+export declare function serviceGateRows(reg: LifecycleRegistry, binding: ServiceAssignmentBinding): ServiceGateRows;
+/** Create the unmintable endpoint gate before native root activation. Never adopts a different assignment. */
+export declare function createPendingServiceGate(reg: LifecycleRegistry, binding: ServiceAssignmentBinding): Promise<ServiceGateRead>;
+/** Current native access prerequisites, not a serving grant or an issuance release fence.
+ * The host supplies an already signature-validated token and fixes expiresAt before its first
+ * authority read. Final issuance still needs a fresh check and the native serving gate CAS.
+ */
+export declare function readNativeServiceAccess(reg: LifecycleRegistry, reader: ConnectReader, expected: ServiceAssignmentBinding, raw: ValidatedUserToken, expiresAt: number): Promise<{
+    witness: ServiceRegistrationWitness;
+    gateRevision: number;
+    expiresAt: number;
+}>;
+/** Final approval CAS. The host must first verify the proposal, owner consent and operator target policy. */
+export declare function approveNativeServiceGate(reg: LifecycleRegistry, binding: ServiceAssignmentBinding, args: {
+    expectedRevision: number;
+    rootCredentialId: string;
+    approvalDigest: string;
+    nameAuthorityRevision: number;
+    approvalExpiresAt: number | null;
+    callerCeiling: EpCapability[];
+}): Promise<ServiceGateRead>;
+/** The host withholds both access and renewal material until this monotonic activation CAS wins. */
+export declare function markNativeServiceActivated(reg: LifecycleRegistry, binding: ServiceAssignmentBinding, args: {
+    expectedRevision: number;
+    witness: ServiceRegistrationWitness;
+}): Promise<ServiceGateRead>;
+/** Durable deny-new only. This is never a terminal retirement result or broker absence proof. */
+export declare function denyNativeServiceGate(reg: LifecycleRegistry, binding: ServiceAssignmentBinding, args: {
+    expectedRevision: number;
+    operationId: string;
+}): Promise<ServiceGateRead>;
+/** Fence cancellation before the endpoint gate exists. Native UID cancellation remains a separate required barrier. */
+export declare function fenceUncreatedServiceGate(reg: LifecycleRegistry, binding: ServiceAssignmentBinding, operationId: string): Promise<ServiceGateRead>;
+export {};
+//# sourceMappingURL=native-service-gate.d.ts.map

package/dist/native-service-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-service-gate.d.ts","sourceRoot":"","sources":["../src/native-service-gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAGoB,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,KAAK,oBAAoB,EAC3F,KAAK,0BAA0B,EAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAGjF,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AACD,KAAK,UAAU,GAAG,eAAe,GAAG;IAAE,eAAe,EAAE,SAAS,CAAC;IAAC,gBAAgB,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAC3G,UAAU,eAAe;IAAG,GAAG,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAoB/D,kGAAkG;AAClG,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAM3I;AAkCD;yFACyF;AACzF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAAC;IACrC,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,gGAAgG;IAChG,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IAChD,2FAA2F;IAC3F,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;CACpE;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,wBAAwB,GAAG,eAAe,CAc1G;AAED,8GAA8G;AAC9G,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,eAAe,CAAC,CAMlI;AAuBD;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EACzF,QAAQ,EAAE,wBAAwB,EAAE,GAAG,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IACvF,OAAO,EAAE,0BAA0B,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;CAC9E,CAAC,CAgDH;AAED,6GAA6G;AAC7G,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE;IAC9G,gBAAgB,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,qBAAqB,EAAE,MAAM,CAAC;IAC1G,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,EAAE,YAAY,EAAE,CAAC;CACjE,GAAG,OAAO,CAAC,eAAe,CAAC,CAe3B;AAED,oGAAoG;AACpG,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE;IAChH,gBAAgB,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,0BAA0B,CAAC;CAC/D,GAAG,OAAO,CAAC,eAAe,CAAC,CAkB3B;AAED,iGAAiG;AACjG,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE;IAC3G,gBAAgB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;CAC/C,GAAG,OAAO,CAAC,eAAe,CAAC,CAK3B;AAED,uHAAuH;AACvH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAOxJ"}